I write on behalf of the Software Finance and Tax Executives Council (SoFTEC) to comment on the Commission's proposed new rules under Sections 404, 406 and 407 of the Sarbanes-Oxley Act regarding financial experts, internal controls and codes of ethics raised in the notice of proposed rulemaking.

SoFTEC is a national trade association providing software industry focused public policy advocacy in the ears of tax, finance and accounting. Many SoFTEC members are publicly traded and thus are interested in the proposed rules regarding financial experts, internal controls and codes of ethics. The members seek to have their comments on the proposed rules voiced through this letter.

A. Financial Experts:

Section 407 of the Sarbanes-Oxley Act, requires that the Commission adopt rules (1) requiring that companies disclose whether their audit committees include at least one member who is a financial expert; and (2) defining what the term "financial expert" means.

1. Proposed New Disclosures:

In connection with the congressional directive, the Commission proposes new rules requiring that companies include a number of new disclosures in their Exchange Act filings. Under the proposed new rules, companies would be required to disclose the number and names of persons that the board of directors has determined to be the "financial experts" serving on the company's audit committee and whether they are independent of management, and if not, an explanation of why they are not. In addition, the proposed new rules would require that boards of directors, in certain circumstances, disclose the bases for determining that certain members are "financial experts" as that term is defined. The goal of these proposed new rules is to provide investors with sufficient information for them to judge the qualifications of those board members serving as financial experts.

While SoFTEC supports requiring the disclosure of the criteria used by boards in determining that one or more of their number is/are a financial expert(s), we do not support requiring disclosure of the actual basis for reaching that determination in the circumstances where such disclosures would be required. We believe that disclosures of the backgrounds of the members of the board and the criteria used in determining that the requirement that the board have a financial expert has been met should be sufficient to provide investors with sufficient information for them to reach their own conclusions. Investors, armed with such disclosures, would then be free to agree or disagree with the board's conclusion. However, requiring disclosure of the actual deliberative process used by the board in selecting a financial expert could chill that process.

SoFTEC also is concerned that requiring the disclosure of the name or names of the financial expert(s) could give investors the misperception that the financial expert bears a different level of responsibility than the other members of the board and could deter otherwise qualified board members from agreeing to the "financial expert" designation. We believe that all members of boards of directors bear an equal obligation to oversee management and to ensure that financial statements fairly and accurately portray the financial and operational performance of the company. The requirement of the Sarbanes-Oxley Act that boards of directors have a financial expert is not intended to enhance the legal responsibility of the persons receiving such designations; the requirement is intended to enhance the level of oversight by the board.

In the event the Commission decides to go ahead with a rule requiring the disclosure of the names of those board members receiving the "financial expert" designation, such a rule should include accompanying language that would clarify that such designation does not in any way imbue such board members with some sort of enhanced legal liability not shared by the other board members.

SoFTEC also is concerned about the interplay between these proposed new rules and related stock exchange listing requirements. Section 301(m) of the Sarbanes-Oxley Act requires that the Commission promulgate rules that would require the stock exchange to delist companies not in compliance with the audit committee provisions of the Act. The stock exchanges are in the process of revising their listing standards so that they comply with the Act.

For instance, The NASDAQ Stock Market recently proposed a new listing standard that would affirmatively require that a listed company have a financial expert with qualifications similar to those required by Section 404 of the Act. See NASDAQ Stock Market Proposed Rule 4350(d)(2)(A)(ii) (Oct. 9, 2003, File No. SR-NASD-2002-141). There is a disconnect between the Act/SEC rules, which merely requires disclosure of whether or not there is a financial expert, and the proposed NASDAQ listing standards, which would affirmatively require a financial expert. An issuer could potentially face delisting if it has no financial expert even though the law does not require the presence of one.

In order to permit better coordination between the Commission's final rules and stock exchange listing standards, we suggest that any final rules regarding financial experts be accompanied by a transition period of at least 18-months. This would give the stock exchanges plenty of time to propose and finalize new listing standards that are consistent with the Commission's rules. In addition, there likely will be stiff competition by boards of directors for qualified financial experts. A longer transition period will provide plenty of time for a larger pool of qualified financial experts to be identified and recruited.

2. Definition of "Financial Expert:"

The Sarbanes-Oxley Act requires that the Commission, in defining the term "financial expert," consider whether a person has, through education and experience as a public accountant or auditor or a principal financial officer, controller, or principal accounting officer of an issuer, or from a position involving the performance of similar functions:

an understanding of generally accepted accounting principles and financial statements;

experience in: (a) the preparation or auditing of financial statements of generally comparable issuers; and (b) the application of such principles in connection with the accounting for estimates, accruals, and reserves;

experience with internal accounting controls; and

an understanding of audit committee functions.

The Commission's proposed rules incorporate these elements from the statute. However, the statute only requires that the Commission "consider" those elements in crafting a definition, it does not make those criteria mandatory. In recognition of the precatory nature of the statute, the proposed rules also permit a company to designate as their financial expert board members who do not literally meet the job titles listed in the statute, if the person has experience in a position that results, in the judgment of the board of directors, in the person having similar expertise and experience, provided such individual, irrespective of title and background, meets the test set forth above.

While SoFTEC applauds the inclusion of this additional provision, which will provide boards of directors with some limited flexibility in appointing qualified financial experts, we are concerned that it is too narrow because it is tempered with the admonition that in order "[t]o qualify as a financial expert, a person would, in all cases, have to possess all of the attributes listed in the proposed definition." This is inconsistent with other statements contained in the notice of proposed rulemaking that "[in] determining whether a potential financial expert has all of the requisite attributes, the board of directors must evaluate the totality of an individual's education and experience" and that "[t]he company should consider a variety of factors in making that evaluation." Given the insistence that any financial expert must possess all of the above-described attributes, we believe that the flexibility that the SEC seems to want to provide is, at best, illusory.

Rather than distill the list of attributes down to the mandatory, rigid elements set forth in the proposed rule, the Commission should adopt the "totality of an individual's education and experience" as the rule and incorporate the various factors from the lengthier list set forth in the notice of proposed rulemaking and the themes set forth below. We think this would provide added flexibility in designating financial experts.

However, our principle concern with the financial expert definition criteria is, given the requirement that such individuals have direct experience in the preparation or auditing of financial statements, they will lead to the selection of individuals who will focus too narrowly on the minutiae of accounting standards and auditing practices. We do not believe such expertise, in and of itself, will aid in the oversight of management by boards of directors. After all, Enron's board of directors had members who more than met the criteria set forth in the statute and the proposed rules. However, the Enron board, despite such expertise, was unable to appreciate that the business it was overseeing was a mirage. The problem with the Enron board was not that it lacked the requisite expertise; Enron's board simply failed to carry out its management oversight responsibilities. Simply designating certain board members as financial experts will not ensure that boards of directors carry out their oversight duties.

Nevertheless, Congress has seen fit to permit, but not require, that companies have designated financial experts on their boards of directors and has ordered the Commission to promulgate implementing rules. The Commission's notice of proposed rulemaking asks whether the proposed definition of financial expert should be modified, whether the five attributes adequately describe the qualities that a financial expert should have and whether additional attributes should be included. SoFTEC believes that the definition of financial expert should be modified to make the requirement that the financial expert have direct experience in the preparation or auditing of financial statement merely another one of the factors to consider and add additional criteria relating to that individual's ability to understand and evaluate financial statements. We believes this is needed because the original attributes set forth in Sarbanes-Oxley, and carried forward in the proposed rule as mandatory requirements, do not adequately describe and may even narrowly restrict the qualities that a financial expert should possess.

Our view is that oversight is enhanced when boards of directors include members with more comprehensive business experience. The financial expert criteria should be augmented with additional criteria that will ensure that financial experts have broader business experience beyond what the financial accounting-focused nature contained in the proposed criteria. For instance, nothing in the existing criteria will ensure that financial experts will be able to understand thoroughly the nature of the business and its operations, the risks and challenges it faces and the ability to judge whether the financial statements presented by management comport with the foregoing.

Few will deny that Jack Welch, the former CEO of General Electric, is a financial expert in the general sense. However, it is doubtful that Mr. Welch, under the strict criteria set forth in the proposed rules, would qualify as a financial expert on any board on which he served, even if those boards availed themselves of the "similar experience" provision. Yet, we think that the rules defining financial experts should encompass those board members who, like Mr. Welch, bring hard-core business experience to the board table.

No doubt, the financial accounting and audit expertise contained in the proposed rules would be helpful to any board of directors. However, the criteria seem to us more suited to providing many green pastures for retired accounting firm audit partners than enhancing the oversight of management by boards of directors.

B. Codes of Ethics:

Section 406 of the Sarbanes-Oxley Act mandates that the Commission adopt rules requiring that companies disclose whether they have adopted a code of ethics for their senior financial officers, and if not, the reasons therefore, as well as any changes to, or waiver of any provision of, that code of ethics. The rules proposed by the Commission in furtherance of the Act extend this disclosure requirement to whether the code of ethics applies to the principle executive officer and asks for comment on whether the disclosure requirement ought to be extended to the board. In addition, the proposed rules would require that the code of ethics be made an exhibit to the annual report.

SoFTEC believes that all publicly traded companies should have a code of ethics, applicable to the board of directors, the principle executive officer, and to a limited class of financial officers, which contains all of the elements set forth in the proposed rules. If a company does not have such a code of ethics, it should provide a public explanation why it does not have one.

That having been said, we are concerned that too much regulation of corporate codes of ethics may confuse the line between conduct which is unethical that that which rises to the level of illegal. We are concerned companies may be subject to harassment lawsuits seeking enforcement of codes of ethics. Such lawsuits would be expensive to defend and distract management from their day-to-day duties of running the company. For this reason, we believe that the Commission should strike the appropriate disclosure balance and opt for rules that more closely follow the statute.

Rather than require public disclosure of the details of corporate codes of ethics, the SEC should monitor compliance with is rules and scrutinize codes of ethics as part of its routine examination of financial statements. If a company publicly discloses that it has a code of ethics that, on routine examination by the Commission, is found not to comply with the rules, appropriate enforcement action could be taken. Such will ensure compliance with the rules and minimize disruption of management.

If the Commission proceeds with the disclosure requirements set forth in the proposed rules, we urge that they be accompanied by materiality thresholds. For instance, the rules propose that a Form 8-K be filed whenever a change is made to a code of ethics. We believe that such a filing only should be required for material changes to codes of ethics and not be required for technical, non-material, changes.

Additionally, the rules propose that a Form 8-K be filed whenever a waiver of the code of ethics is granted to an employee covered by the code. We believe that this requirement should not apply in situations where the code of ethics does not proscribe certain conduct as unethical but merely requires that certain conduct cannot be undertaken without obtaining prior approval. For instance, service on the board of directors of a non-profit, while not unethical conduct, might be something that a corporate board might want to give prior approval of for its senior executives and the code of ethics might describe an approval process. In such circumstances, we do not believe that a company should be made to file a Form 8-K when an executive covered by the code of ethics applies for and receives approval to serve on the board of a non-profit.

The notice of proposed rulemaking also asks whether companies that disclose their code of ethics on the Internet also should be required to acquire technology that will provide email notice to investors whenever new information is posted to the website. We believe that such a requirement will chill use of the Internet to make these sorts of disclosures. Companies will need to maintain an investor email address database; maintaining such a database will be expensive and time consuming. We believe that the burdens on companies that use the Internet to make these disclosures should be no greater than the burdens associated with other mandatory forms of disclosure, such as filing a Form 8-K.

The notice of proposed rulemaking also asks whether the rules should regulate the location on corporate websites where information regarding the code of ethics should be found. While we think it generally unwise for the Commission to get into the business of regulating website design, we would not oppose a simple requirement that information regarding codes of ethics be placed on the same part of the company's website where other corporate financial disclosures, such as quarterly earnings releases, annual reports, and other stockholder information are found. If the company does not maintain a website or does not choose to display corporate financial information on it website, there should be no requirement that information regarding codes of ethics be displayed on the website.

The proposed rulemaking dealing with codes of ethics also asks whether the Commission should require by rule that companies disclose their website address and regulate its location. While we find it somewhat strange that this sort of a request for comment would come under the auspices of a notice of proposed rulemaking having to do with codes of ethics, we support it. If a company maintains a website, the address for that website should be made a part of the company's address whenever the company includes a street address on a filing with the Commission. This burden is minimal and will promote the use of the website by investors. This is a lower cost method of providing information to investors.

C. Internal Controls

Section 404 of the Sarbanes-Oxley Act requires that the Commission promulgate rules requiring that annual reports contain an internal control report: (1) stating management's responsibilities for establishing and maintaining adequate internal control structure and procedures for financial reporting; and (2) containing an assessment, as of the end of the company's most recent fiscal year, of the effectiveness of the company's internal controls and procedures for financial reporting.

In furtherance of the Act, the Commission has proposed rules that would require a company's annual report to include an internal control report of management that includes (1) a statement of management's responsibilities for establishing and maintaining adequate internal controls and procedures for financial reporting, (2) conclusions about the effectiveness of the company's internal controls and procedures for financial reporting based on management's evaluation of those controls and procedures as of the end of the company's most recent fiscal year, and (3) statement that the registered public accounting firm that prepared or issued the company's audit report relating to the financial statements included in the company's annual report has attested to, and reported on, management's evaluation of the company's internal controls and procedures for financial reporting.

In addition, Section 404(b) of the Sarbanes-Oxley Act requires that every registered public accounting firm that prepares or issues an audit report for an issuer attest to, and report on, management's assessment of the issuer's internal controls and procedures for financial reporting. The attestation and report required by Section 404(b) must be made in accordance with standards for attestation engagements "issued or adopted" by the Public Company Accounting Oversight Board. The notice of proposed rulemaking asks whether the Commission should delay the effectiveness of any final rules until such time as attestation engagements standards are issued or adopted by the Public Company Accounting Oversight Board.

Unless the Commission intends to set its own attestation engagements standards, SoFTEC believes, if there is to be a requirement that the attestation and report be filed with annual reports, that the effectiveness of such a requirement must be delayed until the Public Company Accounting Oversight Board is up and running and has adopted standards of attestation engagements.

With regard to the question of whether there ought to be quarterly evaluations of both the company's disclosure controls and procedures and its internal controls and procedures for financial reporting, we think it unlikely that such controls will change substantially over course of the annual reporting period. Requiring that such controls be evaluated more frequently will only drive up compliance costs with little if any benefit.

Conclusion

I hope the Commission finds these comments helpful in its deliberations in reaching consensus on final rules. If there are any questions regarding these comments, I can be reached at (202) 331-9533 or mnebergall@softwarefinance.org. I look forward to working with the Commission and its staff on these and other issues of interest to SoFTEC's members.